- NANOG - lists.nanog.org

Re: RPC errors
by John Dvorak 11 Aug '03

11 Aug '03

On Mon, 11 Aug 2003 17:33:33 -0400 Kevin Houle <kjh(a)cert.org> wrote: > > --On Monday, August 11, 2003 02:26:40 PM -0700 Mike Damm > <MikeD(a)irwinresearch.com> wrote: > > >The DCOM exploit that is floating around crashes the Windows RPC service > >when the attacker closes the connection to your system after a successful > >attack. Best bet is to assume any occurrence of crashing RPC services to > >be signs of a compromised system until proven otherwise. > > > >http://www.cert.org/advisories/CA-2003-19.html > > That's good advice. Many of the known exploits cause the RPC service > to crash after the exploit is successful. I'll point out that not all > exploits cause the service failure. So, the absence of an RPC service > failure is likewise not an indicator that a vulnerable machine has > escaped compromise. > > Kevin Interestingly, we have clear examples of boxes which were not infected but on which RPC services did crash. This may suggest that the worm also takes advantage of the unrelated RPC DOS vulnerability (2000 and XP) which I believe MS has still not patched. John

3 2

RE: RPC errors
by Drew Weaver 11 Aug '03

11 Aug '03

Its bloody gorgeous too, my girlfriend's pc rebooted like 9 times, apparently the worm doesn't check to see if its already infected. -----Original Message----- From: Mike Damm [mailto:MikeD@irwinresearch.com] Sent: Monday, August 11, 2003 5:27 PM To: 'Jack Bates'; NANOG Subject: RE: RPC errors The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

RE: RPC errors
by Brennan_Murphy＠NAI.com 11 Aug '03

11 Aug '03

http://vil.nai.com/vil/content/v_100547.htm -BM -----Original Message----- From: Chris Reining [mailto:creining@packetfu.org] Sent: Monday, August 11, 2003 5:36 PM To: Sean Donelan Cc: Jack Bates; NANOG Subject: Re: RPC errors On Mon, Aug 11, 2003 at 04:17:53PM -0400, Sean Donelan wrote: > On Mon, 11 Aug 2003, Jack Bates wrote: > > I'm showing signs of an RPC sweep across one of my networks that's > > killing some XP machines (only XP confirmed). How wide spread is > > this at this time. Also, does anyone know if this is just generating > > a DOS symptom or if I should be looking for backdoors in these > > client systems? > > http://isc.sans.org/diary.html?date=2003-08-11 > The worm uses the RPC DCOM vulnerability to propagate. One it finds a > vulnerable system, it will spawn a shell and use it to download the > actual worm via tftp. > > The name of the binary is msblast.exe. It is packed with UPX and will > self extract. The size of the binary is about 11kByte unpacked, and > 6kBytes > packed: I have a copy of this worm at http://www.packetfu.org/malware/msblast.zip

1 0

RE: RPC errors
by Mike Damm 11 Aug '03

11 Aug '03

The DCOM exploit that is floating around crashes the Windows RPC service when the attacker closes the connection to your system after a successful attack. Best bet is to assume any occurrence of crashing RPC services to be signs of a compromised system until proven otherwise. http://www.cert.org/advisories/CA-2003-19.html -Mike --- Michael Damm, MIS Department, Irwin Research & Development V: 509.457.5080 x298 F: 509.577.0301 E: miked(a)irwinresearch.com -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 1:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

2 1

RE: RPC errors
by Drew Weaver 11 Aug '03

11 Aug '03

Its hitting our Dial-Up customers pretty hard, basically on client side they see "Unexpected Remote Proceedure call, your computer needs to be rebooted" Then that's it. -Drew -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 4:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

RE: RPC errors
by McBurnett, Jim 11 Aug '03

11 Aug '03

Jack, This is that RPC flaw in MicroSoft. I noticed it too.. Got about 20K in 15 hours Jim -----Original Message----- From: Jack Bates [mailto:jbates@brightok.net] Sent: Monday, August 11, 2003 4:12 PM To: NANOG Subject: RPC errors I'm showing signs of an RPC sweep across one of my networks that's killing some XP machines (only XP confirmed). How wide spread is this at this time. Also, does anyone know if this is just generating a DOS symptom or if I should be looking for backdoors in these client systems? -Jack

1 0

Re: Gigabit Media Converter
by Vincent J. Bono 11 Aug '03

11 Aug '03

Thanks but this wont work. We have a Specific frequency (CWDM) on one side. -vb ----- Original Message ----- From: "Curtis Clan" <Curtis.Clan(a)state.tn.us> To: <nanog(a)merit.edu>; <vbono(a)vinny.org> Sent: Monday, August 11, 2003 1:12 PM Subject: Re: Gigabit Media Converter > I believe this is what you are looking > > http://www.transition.com/products/mcon_platform/standalone/gigabit/fsmmm04. htm > > >>> "Vincent J. Bono" <vbono(a)vinny.org> 8/11/2003 12:02:04 PM >>> > > Anyone out ther ever see or hear tell of a device that will let you run > two > GBICs back to back wthout an associated switch and all the trimmings? > > Application is to convert a CWDM GBIC signal to a Multimode one. > > TIA, > Vin >

1 0

Re: [connie.davis@mail.internetseer.com: answerpointe.cctec.com]
by Stewart, William C (Bill), RTSLS 10 Aug '03

10 Aug '03

I'd say keep it. NANOG's archives at Merit are probably more stable than many mailing list archives I've seen, but it's possible that something will happen to it in the next 5-10 years that kills it. Multiple copies of list archives aren't a bad thing, at least for relatively low volume lists like NANOG. Old archives aren't usually highly useful, but once in a while they can provide good insight into the "why did they do that" sorts of questions. The archive at gmane.org munges @ charactes into " <at> " in an attempt to reduce spider infestations, and it's probably not a bad idea except when people are trying to explain specific syntaxes that this garbles. Bill Stewart.

1 0

[connie.davis@mail.internetseer.com: answerpointe.cctec.com]
by Leo Bicknell 10 Aug '03

10 Aug '03

Has anyone else gotten one of these? It appears they are trolling a Nanog archive on the web and sending these out to posters. *sigh* Perhaps it should be a nanog AUP violation to archive the list on the web, and merit could keep a single web archive with the e-mail addresses removed / altered to prevent this sort of harvesting. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

13 14

Network Solutions and Broken E-mail Addresses
by Leo Bicknell 09 Aug '03

09 Aug '03

Sometime recently Network Solutions seems to have stopped accepting "+" as a valid character in an e-mail address. Yes, I did open a ticket via their customer service people, and was given the reply that I needed to use another e-mail address. Per their web form, the only acceptable addresses are [a-zA-Z-_.]+(a)[a-zA-Z-_.]+ (no, they don't put it in a regex, but I did for clarity). Evidence suggests some Network Solutions people read this list, but are unlikely to reply to queries such as mine. That's fine, but if one of you could suggest to the people in the right place that there are many valid e-mail addresses not in that form it would be great. In particular I'm trying to use bicknell+whois(a)ufp.org, which I have used for years. Note to all, they also sent out a recent note that ICANN requires valid contact info for a domain, and if you don't have it they can "unregister" your domain. Well, their web form flags my e-mail as "invalid", even though it works just fine (and it's the address they used to send me the notice). If you use a e-mail that doesn't match the regex above you might want to complain, or change it, or both. A private e-mail from someone at netsol will yeild the ticket number I opened with standard customer service. -- Leo Bicknell - bicknell(a)ufp.org - CCIE 3440 PGP keys at http://www.ufp.org/~bicknell/ Read TMBG List - tmbg-list-request(a)tmbg.org, www.tmbg.org

4 3